<!DOCTYPE html>
<html lang="zh-CN">
    <head>
        <meta charset="utf-8">
        <meta name="viewport" content="width=device-width, initial-scale=1">
        <meta name="robots" content="noodp" />
        <meta http-equiv="X-UA-Compatible" content="IE=edge, chrome=1">
        <title>tcpdump命令高级过滤方式 - Simple Life</title><meta name="Description" content="易娃的Blog"><meta property="og:title" content="tcpdump命令高级过滤方式" />
<meta property="og:description" content="首先了解如何从包头过滤信息 1 2 3 4 5 proto[x:y] : 过滤从x字节开始的y字节数。比如ip[2:2]过滤出3、4字节（第一字节从0开始排） proto[x:y] &amp; z = 0 : pr" />
<meta property="og:type" content="article" />
<meta property="og:url" content="https://alexwuyh.gitee.io/Blog/tcpdump%E5%91%BD%E4%BB%A4%E9%AB%98%E7%BA%A7%E8%BF%87%E6%BB%A4%E6%96%B9%E5%BC%8F/" /><meta property="og:image" content="https://alexwuyh.gitee.io/logo.png"/><meta property="article:section" content="posts" />
<meta property="article:published_time" content="2022-01-29T00:00:00+00:00" />
<meta property="article:modified_time" content="2022-01-29T00:00:00+00:00" />

<meta name="twitter:card" content="summary_large_image"/>
<meta name="twitter:image" content="https://alexwuyh.gitee.io/logo.png"/>

<meta name="twitter:title" content="tcpdump命令高级过滤方式"/>
<meta name="twitter:description" content="首先了解如何从包头过滤信息 1 2 3 4 5 proto[x:y] : 过滤从x字节开始的y字节数。比如ip[2:2]过滤出3、4字节（第一字节从0开始排） proto[x:y] &amp; z = 0 : pr"/>
<meta name="application-name" content="LoveIt">
<meta name="apple-mobile-web-app-title" content="LoveIt"><meta name="theme-color" content="#ffffff"><meta name="msapplication-TileColor" content="#da532c"><link rel="shortcut icon" type="image/x-icon" href="/favicon.ico" />
        <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
        <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png"><link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png"><link rel="mask-icon" href="/safari-pinned-tab.svg" color="#5bbad5"><link rel="manifest" href="/site.webmanifest"><link rel="canonical" href="https://alexwuyh.gitee.io/Blog/tcpdump%E5%91%BD%E4%BB%A4%E9%AB%98%E7%BA%A7%E8%BF%87%E6%BB%A4%E6%96%B9%E5%BC%8F/" /><link rel="prev" href="https://alexwuyh.gitee.io/Blog/2021%E5%B9%B410%E6%9C%88-%E5%87%BA%E5%B7%AE%E6%89%AB%E8%A1%97%E8%AE%B0%E5%BD%95%E4%B9%8B%E6%AD%A6%E6%B1%89%E7%AF%87/" /><link rel="next" href="https://alexwuyh.gitee.io/Blog/tcpdump%E5%91%BD%E4%BB%A4%E4%BD%BF%E7%94%A8%E7%AE%80%E4%BB%8B/" /><link rel="stylesheet" href="/Blog/lib/normalize/normalize.min.css"><link rel="stylesheet" href="/Blog/css/style.min.css"><link rel="stylesheet" href="/Blog/lib/fontawesome-free/all.min.css"><link rel="stylesheet" href="/Blog/lib/animate/animate.min.css"><script type="application/ld+json">
    {
        "@context": "http://schema.org",
        "@type": "BlogPosting",
        "headline": "tcpdump命令高级过滤方式",
        "inLanguage": "zh-CN",
        "mainEntityOfPage": {
            "@type": "WebPage",
            "@id": "https:\/\/alexwuyh.gitee.io\/Blog\/tcpdump%E5%91%BD%E4%BB%A4%E9%AB%98%E7%BA%A7%E8%BF%87%E6%BB%A4%E6%96%B9%E5%BC%8F\/"
        },"genre": "posts","keywords": "TCPDump, Network, Linux","wordcount":  4051 ,
        "url": "https:\/\/alexwuyh.gitee.io\/Blog\/tcpdump%E5%91%BD%E4%BB%A4%E9%AB%98%E7%BA%A7%E8%BF%87%E6%BB%A4%E6%96%B9%E5%BC%8F\/","datePublished": "2022-01-29T00:00:00+00:00","dateModified": "2022-01-29T00:00:00+00:00","publisher": {
            "@type": "Organization",
            "name": ""},"author": {
                "@type": "Person",
                "name": "Alex Wu"
            },"description": ""
    }
    </script></head>
    <body header-desktop="fixed" header-mobile="auto"><script type="text/javascript">(window.localStorage && localStorage.getItem('theme') ? localStorage.getItem('theme') === 'dark' : ('auto' === 'auto' ? window.matchMedia('(prefers-color-scheme: dark)').matches : 'auto' === 'dark')) && document.body.setAttribute('theme', 'dark');</script>

        <div id="mask"></div><div class="wrapper"><header class="desktop" id="header-desktop">
    <div class="header-wrapper">
        <div class="header-title">
            <a href="/Blog/" title="Simple Life"><span id="id-1" class="typeit"></span></a>
        </div>
        <div class="menu">
            <div class="menu-inner"><a class="menu-item" href="/Blog/Blog/posts/"> 文章 </a><a class="menu-item" href="/Blog/Blog/tags/"> 标签 </a><a class="menu-item" href="/Blog/Blog/categories/"> 分类 </a><span class="menu-item delimiter"></span><span class="menu-item search" id="search-desktop">
                        <input type="text" placeholder="搜索文章标题或内容..." id="search-input-desktop">
                        <a href="javascript:void(0);" class="search-button search-toggle" id="search-toggle-desktop" title="搜索">
                            <i class="fas fa-search fa-fw"></i>
                        </a>
                        <a href="javascript:void(0);" class="search-button search-clear" id="search-clear-desktop" title="清空">
                            <i class="fas fa-times-circle fa-fw"></i>
                        </a>
                        <span class="search-button search-loading" id="search-loading-desktop">
                            <i class="fas fa-spinner fa-fw fa-spin"></i>
                        </span>
                    </span><a href="javascript:void(0);" class="menu-item theme-switch" title="切换主题">
                    <i class="fas fa-adjust fa-fw"></i>
                </a>
            </div>
        </div>
    </div>
</header><header class="mobile" id="header-mobile">
    <div class="header-container">
        <div class="header-wrapper">
            <div class="header-title">
                <a href="/Blog/" title="Simple Life"><span id="id-2" class="typeit"></span></a>
            </div>
            <div class="menu-toggle" id="menu-toggle-mobile">
                <span></span><span></span><span></span>
            </div>
        </div>
        <div class="menu" id="menu-mobile"><div class="search-wrapper">
                    <div class="search mobile" id="search-mobile">
                        <input type="text" placeholder="搜索文章标题或内容..." id="search-input-mobile">
                        <a href="javascript:void(0);" class="search-button search-toggle" id="search-toggle-mobile" title="搜索">
                            <i class="fas fa-search fa-fw"></i>
                        </a>
                        <a href="javascript:void(0);" class="search-button search-clear" id="search-clear-mobile" title="清空">
                            <i class="fas fa-times-circle fa-fw"></i>
                        </a>
                        <span class="search-button search-loading" id="search-loading-mobile">
                            <i class="fas fa-spinner fa-fw fa-spin"></i>
                        </span>
                    </div>
                    <a href="javascript:void(0);" class="search-cancel" id="search-cancel-mobile">
                        取消
                    </a>
                </div><a class="menu-item" href="/Blog/Blog/posts/" title="">文章</a><a class="menu-item" href="/Blog/Blog/tags/" title="">标签</a><a class="menu-item" href="/Blog/Blog/categories/" title="">分类</a><a href="javascript:void(0);" class="menu-item theme-switch" title="切换主题">
                <i class="fas fa-adjust fa-fw"></i>
            </a></div>
    </div>
</header>
<div class="search-dropdown desktop">
    <div id="search-dropdown-desktop"></div>
</div>
<div class="search-dropdown mobile">
    <div id="search-dropdown-mobile"></div>
</div>
<main class="main">
                <div class="container"><div class="toc" id="toc-auto">
            <h2 class="toc-title">目录</h2>
            <div class="toc-content" id="toc-content-auto"></div>
        </div><article class="page single"><h1 class="single-title animated flipInX">tcpdump命令高级过滤方式</h1><div class="post-meta">
            <div class="post-meta-line"><span class="post-author"><a href="/Blog/" title="Author" rel=" author" class="author"><i class="fas fa-user-circle fa-fw"></i>Alex Wu</a></span>&nbsp;<span class="post-category">收录于 <a href="/Blog/categories/linux/"><i class="far fa-folder fa-fw"></i>Linux</a>&nbsp;<a href="/Blog/categories/network/"><i class="far fa-folder fa-fw"></i>Network</a></span></div>
            <div class="post-meta-line"><i class="far fa-calendar-alt fa-fw"></i>&nbsp;<time datetime="2022-01-29">2022-01-29</time>&nbsp;<i class="fas fa-pencil-alt fa-fw"></i>&nbsp;约 4051 字&nbsp;
                <i class="far fa-clock fa-fw"></i>&nbsp;预计阅读 9 分钟&nbsp;<span id="/Blog/tcpdump%E5%91%BD%E4%BB%A4%E9%AB%98%E7%BA%A7%E8%BF%87%E6%BB%A4%E6%96%B9%E5%BC%8F/" class="leancloud_visitors" data-flag-title="tcpdump命令高级过滤方式">
                        <i class="far fa-eye fa-fw"></i>&nbsp;<span class=leancloud-visitors-count></span>&nbsp;次阅读
                    </span>&nbsp;</div>
        </div><div class="details toc" id="toc-static"  kept="true">
                <div class="details-summary toc-title">
                    <span>目录</span>
                    <span><i class="details-icon fas fa-angle-right"></i></span>
                </div>
                <div class="details-content toc-content" id="toc-content-static"><nav id="TableOfContents">
  <ul>
    <li><a href="#ip头ipv4">IP头（IPV4）</a></li>
    <li><a href="#ip选项">IP选项</a></li>
    <li><a href="#分片标记">分片标记</a></li>
    <li><a href="#抓分片包">抓分片包</a></li>
    <li><a href="#匹配小ttl">匹配小TTL</a></li>
    <li><a href="#抓大于x字节的包">抓大于X字节的包</a></li>
    <li><a href="#更多的过滤方式">更多的过滤方式</a></li>
    <li><a href="#常用的字段偏移名字">常用的字段偏移名字</a></li>
    <li><a href="#抓smtp数据">抓SMTP数据</a></li>
    <li><a href="#抓http-get数据">抓HTTP GET数据</a></li>
    <li><a href="#抓ssh返回">抓SSH返回</a></li>
  </ul>
</nav></div>
            </div><div class="content" id="content"><p>首先了解如何从包头过滤信息</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span><span class="lnt">4
</span><span class="lnt">5
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">proto<span class="o">[</span>x:y<span class="o">]</span>          : 过滤从x字节开始的y字节数。比如ip<span class="o">[</span>2:2<span class="o">]</span>过滤出3、4字节（第一字节从0开始排）
proto<span class="o">[</span>x:y<span class="o">]</span> <span class="p">&amp;</span> <span class="nv">z</span> <span class="o">=</span> <span class="m">0</span>  : proto<span class="o">[</span>x:y<span class="o">]</span>和z的与操作为0
proto<span class="o">[</span>x:y<span class="o">]</span> <span class="p">&amp;</span> z !<span class="o">=</span><span class="m">0</span>  : proto<span class="o">[</span>x:y<span class="o">]</span>和z的与操作不为0
proto<span class="o">[</span>x:y<span class="o">]</span> <span class="p">&amp;</span> <span class="nv">z</span> <span class="o">=</span> z  : proto<span class="o">[</span>x:y<span class="o">]</span>和z的与操作为z
proto<span class="o">[</span>x:y<span class="o">]</span> <span class="o">=</span> z      : proto<span class="o">[</span>x:y<span class="o">]</span>等于z
</code></pre></td></tr></table>
</div>
</div><p>操作符 : <strong>&gt;, &lt;, &gt;=, &lt;=, =, !=</strong></p>
<h2 id="ip头ipv4">IP头（IPV4）</h2>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt"> 1
</span><span class="lnt"> 2
</span><span class="lnt"> 3
</span><span class="lnt"> 4
</span><span class="lnt"> 5
</span><span class="lnt"> 6
</span><span class="lnt"> 7
</span><span class="lnt"> 8
</span><span class="lnt"> 9
</span><span class="lnt">10
</span><span class="lnt">11
</span><span class="lnt">12
</span><span class="lnt">13
</span><span class="lnt">14
</span><span class="lnt">15
</span><span class="lnt">16
</span><span class="lnt">17
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">0                   1                   2                   3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version|  IHL  |Type of Service|          Total Length         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|         Identification        |Flags|      Fragment Offset    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Time to Live |    Protocol   |         Header Checksum       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                       Source Address                          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Destination Address                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Options                    |    Padding    | &lt;-- optional
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                            DATA ...                           |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
</code></pre></td></tr></table>
</div>
</div><blockquote>
<p><strong>中文：</strong></p>
<p><img
        class="lazyload"
        src="/Blog/svg/loading.min.svg"
        data-src="https://upyun.oneone.life/upyun-img/20210303171904.png"
        data-srcset="https://upyun.oneone.life/upyun-img/20210303171904.png, https://upyun.oneone.life/upyun-img/20210303171904.png 1.5x, https://upyun.oneone.life/upyun-img/20210303171904.png 2x"
        data-sizes="auto"
        alt="https://upyun.oneone.life/upyun-img/20210303171904.png"
        title="268981-20180530231811755-859452716.jpg-24.1kB" /></p>
</blockquote>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt"> 1
</span><span class="lnt"> 2
</span><span class="lnt"> 3
</span><span class="lnt"> 4
</span><span class="lnt"> 5
</span><span class="lnt"> 6
</span><span class="lnt"> 7
</span><span class="lnt"> 8
</span><span class="lnt"> 9
</span><span class="lnt">10
</span><span class="lnt">11
</span><span class="lnt">12
</span><span class="lnt">13
</span><span class="lnt">14
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-c" data-lang="c"><span class="cm">/*IP头定义，共20个字节*/</span>
<span class="k">typedef</span> <span class="k">struct</span> <span class="n">_IP_HEADER</span>
<span class="p">{</span>
	<span class="kt">char</span> <span class="n">m_cVersionAndHeaderLen</span><span class="p">;</span>     　　<span class="c1">//版本信息(前4位)，头长度(后4位)
</span><span class="c1"></span>	<span class="kt">char</span> <span class="n">m_cTypeOfService</span><span class="p">;</span>      　　　　　 <span class="c1">// 服务类型8位
</span><span class="c1"></span>	<span class="kt">short</span> <span class="n">m_sTotalLenOfPacket</span><span class="p">;</span>    　　　　<span class="c1">//数据包长度
</span><span class="c1"></span>	<span class="kt">short</span> <span class="n">m_sPacketID</span><span class="p">;</span>      　　　　　　　 <span class="c1">//数据包标识
</span><span class="c1"></span>	<span class="kt">short</span> <span class="n">m_sSliceinfo</span><span class="p">;</span>      　　　　　　　  <span class="c1">//分片使用
</span><span class="c1"></span>	<span class="kt">char</span> <span class="n">m_cTTL</span><span class="p">;</span>        　　　　　　　　　　<span class="c1">//存活时间
</span><span class="c1"></span>	<span class="kt">char</span> <span class="n">m_cTypeOfProtocol</span><span class="p">;</span>    　　　　　 <span class="c1">//协议类型
</span><span class="c1"></span>	<span class="kt">short</span> <span class="n">m_sCheckSum</span><span class="p">;</span>      　　　　　　 <span class="c1">//校验和
</span><span class="c1"></span>	<span class="kt">unsigned</span> <span class="kt">int</span> <span class="n">m_uiSourIp</span><span class="p">;</span>     　　　　　<span class="c1">//源ip
</span><span class="c1"></span>	<span class="kt">unsigned</span> <span class="kt">int</span> <span class="n">m_uiDestIp</span><span class="p">;</span>     　　　　　<span class="c1">//目的ip
</span><span class="c1"></span><span class="p">}</span> <span class="n">__attribute__</span><span class="p">((</span><span class="n">packed</span><span class="p">))</span><span class="n">IP_HEADER</span><span class="p">,</span> <span class="o">*</span><span class="n">PIP_HEADER</span> <span class="p">;</span>
</code></pre></td></tr></table>
</div>
</div><ul>
<li>
<p><strong>版本</strong>：</p>
<p>​	指IP协议的版本，通信双方使用的IP协议版本必须一致。一般的值为0100（IPv4），0110（IPv6）。</p>
</li>
<li>
<p><strong>首部长度</strong>：</p>
</li>
</ul>
<p>​	长度4比特。这个字段的作用是为了描述IP包头的长度，因为在IP包头中有变长的可选部分。该部分占4个bit位，单位为32bit（4个字节），即本区域值= IP头部长度（单位为bit）/(8<em>4)，因此，一个IP包头的长度最长为“1111”，即15</em>4＝60个字节。IP包头最小长度为20字节。</p>
<ul>
<li>
<p><strong>优先级与服务类型</strong>：</p>
<p>​	长度8比特，定义了数据包传输的紧急程度以及时延、可靠性、传输成本等。</p>
</li>
<li>
<p><strong>总长度</strong>：</p>
</li>
</ul>
<p>​	16比特，以字节为单位描述IP包的总长度（包括头部和数据两部分），最大值为65535。第二行中标识符、标志和段偏移量通常联合使用，用于数据拆分时的分组和重组。</p>
<ul>
<li><strong>标识符</strong>：</li>
</ul>
<p>​	对于上层发来的较大的数据包，往往需要拆分。路由器将一个大包进行拆分后，拆出来的所有部分被标上相同的值，该值即为标识符，用于告诉目的端哪些包属于同一个大包。</p>
<ul>
<li><strong>标志</strong>：</li>
</ul>
<p>​	长度3比特。该字段第一位不使用。第二位是DF（Don&rsquo;t Fragment）位，DF位设为1时表明路由器不能对该上层数据包分段。如果一个上层数据包无法在不分段的情况下进行转发，则路由器会丢弃该上层数据包并返回一个错误信息。第三位是MF（More Fragments）位，当路由器对一个上层数据包分段，则路由器会在除了最后一个分段的IP包的包头中将MF位设为1。</p>
<ul>
<li><strong>段偏移量</strong>：</li>
</ul>
<p>​	长度13比特，表示一个数据包在原先被拆分前的大包中的位置。接收端据此来还原和组装IP包。</p>
<ul>
<li><strong>TTL</strong>：</li>
</ul>
<p>​	表示IP包的生存时间，长度8比特。长度8比特。当IP包进行传送时，先会对该字段赋予某个特定的值。当IP包经过每一个沿途的路由器的时候，每个沿途的路由器会将IP包的TTL值减少1。如果TTL减少为0，则该IP包会被丢弃。这个字段可以防止由于路由环路而导致IP包在网络中不停被转发。</p>
<ul>
<li><strong>协议号</strong>：</li>
</ul>
<p>​	长度8比特，标识上一层即传输层在本次数据传输中所使用的协议。比如6代表TCP，17代表UDP等</p>
<ul>
<li><strong>首部校验和</strong>：</li>
</ul>
<p>​	长度16位。用来做IP头部的正确性检测，但不包含数据部分。 因为每个路由器要改变TTL的值,所以路由器会为每个通过的数据包重新计算这个值。</p>
<ul>
<li><strong>源地址</strong>：</li>
</ul>
<p>​	长度32比特，标识IP包的起源地址。</p>
<ul>
<li><strong>目标地址</strong>：</li>
</ul>
<p>​	长度32比特，表示IP包的目的地址。</p>
<ul>
<li><strong>可选项</strong>：</li>
</ul>
<p>​	可变长字段，主要用于测试，由起源设备跟据需要改写。</p>
<ul>
<li><strong>填充</strong>：</li>
</ul>
<p>​	因为IP包头长度（Header Length）部分的单位为32bit，所以IP包头的长度必须为32bit的整数倍。因此，在可选项后面，IP协议会填充若干个0，以达到32bit的整数倍</p>
<h2 id="ip选项">IP选项</h2>
<p><code>一般</code>的IP头是20字节，但IP头有选项设置，不能直接从偏移21字节处读取数据。IP头有个长度字段可以知道头长度是否大于20字节。</p>
<p>通常第一个字节的二进制值是：01000101，</p>
<p>分成两个部分：</p>
<blockquote>
<p><strong>0100 = 4</strong> 表示IP版本</p>
<p><strong>0101 = 5</strong> 表示IP头32 bit的块数，</p>
<p>5 x 32 bits = 160 bits or 20 bytes</p>
</blockquote>
<p>如果第一字节第二部分的值大于5，那么表示头有IP选项。</p>
<p>下面介绍有过滤方法</p>
<p>**0100 0101 **: 第一字节的二进制
<strong>0000 1111</strong> : 与操作
&lt;=========
<strong>0000 0101</strong> : 结果</p>
<p>正确的过滤方法:</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;ip[0] &amp; 15 &gt; 5&#39;</span>
</code></pre></td></tr></table>
</div>
</div><p>或者</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;ip[0] &amp; 0x0f &gt; 5&#39;</span>　
</code></pre></td></tr></table>
</div>
</div><h2 id="分片标记">分片标记</h2>
<p>当发送端的MTU大于到目的路径链路上的MTU时就会被分片，分片信息在IP头的第七和第八字节：</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback"> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |Flags|      Fragment Offset    |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
</code></pre></td></tr></table>
</div>
</div><p><strong>Bit 0</strong>: 保留，必须是0
<strong>Bit 1</strong>: (DF) 0 = 可能分片, 1 = 不分片
<strong>Bit 2</strong>: (MF) 0 = 最后的分片, 1 = 还有分片</p>
<p><strong>Fragment Offset</strong>字段只有在分片的时候才使用。</p>
<p>要抓带DF位标记的不分片的包，第七字节的值应该是：</p>
<p>01000000 = 64</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;ip[6] = 64&#39;</span>
</code></pre></td></tr></table>
</div>
</div><h2 id="抓分片包">抓分片包</h2>
<ul>
<li>匹配MF，分片包</li>
</ul>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;ip[6] = 32&#39;</span>
</code></pre></td></tr></table>
</div>
</div><p>最后分片包的开始3位是0，但是有Fragment Offset字段。</p>
<ul>
<li>匹配分片和最后分片</li>
</ul>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;((ip[6:2] &gt; 0) and (not ip[6] = 64))&#39;</span>
</code></pre></td></tr></table>
</div>
</div><p>测试分片可以用下面的命令：</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">ping -M want -s <span class="m">3000</span> 192.168.1.1
</code></pre></td></tr></table>
</div>
</div><h2 id="匹配小ttl">匹配小TTL</h2>
<p>TTL字段在第九字节，并且正好是完整的一个字节，TTL最大值是255，二进制为11111111。</p>
<p>可以用下面的命令验证一下：</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">$ ping -M want -s <span class="m">3000</span> -t <span class="m">256</span> 192.168.1.200
ping: ttl <span class="m">256</span> out of range
</code></pre></td></tr></table>
</div>
</div><div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback"> +-+-+-+-+-+-+-+-+
 |  Time to Live |
 +-+-+-+-+-+-+-+-+
</code></pre></td></tr></table>
</div>
</div><ul>
<li>在网关可以用下面的命令看看网络中谁在使用<code>traceroute</code></li>
</ul>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;ip[8] &lt; 5&#39;</span>
</code></pre></td></tr></table>
</div>
</div><h2 id="抓大于x字节的包">抓大于X字节的包</h2>
<ul>
<li>大于600字节</li>
</ul>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;ip[2:2] &gt; 600&#39;</span>
</code></pre></td></tr></table>
</div>
</div><h2 id="更多的过滤方式">更多的过滤方式</h2>
<p>首先还是需要知道TCP基本结构</p>
<ul>
<li>TCP头</li>
</ul>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt"> 1
</span><span class="lnt"> 2
</span><span class="lnt"> 3
</span><span class="lnt"> 4
</span><span class="lnt"> 5
</span><span class="lnt"> 6
</span><span class="lnt"> 7
</span><span class="lnt"> 8
</span><span class="lnt"> 9
</span><span class="lnt">10
</span><span class="lnt">11
</span><span class="lnt">12
</span><span class="lnt">13
</span><span class="lnt">14
</span><span class="lnt">15
</span><span class="lnt">16
</span><span class="lnt">17
</span><span class="lnt">18
</span><span class="lnt">19
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="m">0</span>                   <span class="m">1</span>                   <span class="m">2</span>                   <span class="m">3</span>
<span class="m">0</span> <span class="m">1</span> <span class="m">2</span> <span class="m">3</span> <span class="m">4</span> <span class="m">5</span> <span class="m">6</span> <span class="m">7</span> <span class="m">8</span> <span class="m">9</span> <span class="m">0</span> <span class="m">1</span> <span class="m">2</span> <span class="m">3</span> <span class="m">4</span> <span class="m">5</span> <span class="m">6</span> <span class="m">7</span> <span class="m">8</span> <span class="m">9</span> <span class="m">0</span> <span class="m">1</span> <span class="m">2</span> <span class="m">3</span> <span class="m">4</span> <span class="m">5</span> <span class="m">6</span> <span class="m">7</span> <span class="m">8</span> <span class="m">9</span> <span class="m">0</span> <span class="m">1</span>
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
<span class="p">|</span>          Source Port          <span class="p">|</span>       Destination Port        <span class="p">|</span>
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
<span class="p">|</span>                        Sequence Number                        <span class="p">|</span>
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
<span class="p">|</span>                    Acknowledgment Number                      <span class="p">|</span>
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
<span class="p">|</span>  Data <span class="p">|</span>       <span class="p">|</span>C<span class="p">|</span>E<span class="p">|</span>U<span class="p">|</span>A<span class="p">|</span>P<span class="p">|</span>R<span class="p">|</span>S<span class="p">|</span>F<span class="p">|</span>                               <span class="p">|</span>
<span class="p">|</span> Offset<span class="p">|</span>  Res. <span class="p">|</span>W<span class="p">|</span>C<span class="p">|</span>R<span class="p">|</span>C<span class="p">|</span>S<span class="p">|</span>S<span class="p">|</span>Y<span class="p">|</span>I<span class="p">|</span>            Window             <span class="p">|</span>
<span class="p">|</span>       <span class="p">|</span>       <span class="p">|</span>R<span class="p">|</span>E<span class="p">|</span>G<span class="p">|</span>K<span class="p">|</span>H<span class="p">|</span>T<span class="p">|</span>N<span class="p">|</span>N<span class="p">|</span>                               <span class="p">|</span>
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
<span class="p">|</span>           Checksum            <span class="p">|</span>         Urgent Pointer        <span class="p">|</span>
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
<span class="p">|</span>                    Options                    <span class="p">|</span>    Padding    <span class="p">|</span>
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
<span class="p">|</span>                             data                              <span class="p">|</span>
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
</code></pre></td></tr></table>
</div>
</div><p>　　<img
        class="lazyload"
        src="/Blog/svg/loading.min.svg"
        data-src="https://upyun.oneone.life/upyun-img/20210303171915.png"
        data-srcset="https://upyun.oneone.life/upyun-img/20210303171915.png, https://upyun.oneone.life/upyun-img/20210303171915.png 1.5x, https://upyun.oneone.life/upyun-img/20210303171915.png 2x"
        data-sizes="auto"
        alt="https://upyun.oneone.life/upyun-img/20210303171915.png"
        title="268981-20180530234728337-1534993130.jpg-60.1kB" /></p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt"> 1
</span><span class="lnt"> 2
</span><span class="lnt"> 3
</span><span class="lnt"> 4
</span><span class="lnt"> 5
</span><span class="lnt"> 6
</span><span class="lnt"> 7
</span><span class="lnt"> 8
</span><span class="lnt"> 9
</span><span class="lnt">10
</span><span class="lnt">11
</span><span class="lnt">12
</span><span class="lnt">13
</span><span class="lnt">14
</span><span class="lnt">15
</span><span class="lnt">16
</span><span class="lnt">17
</span><span class="lnt">18
</span><span class="lnt">19
</span><span class="lnt">20
</span><span class="lnt">21
</span><span class="lnt">22
</span><span class="lnt">23
</span><span class="lnt">24
</span><span class="lnt">25
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-c" data-lang="c"> 
<span class="cm">/*TCP头定义，共20个字节*/</span>
<span class="k">typedef</span> <span class="k">struct</span> <span class="n">_TCP_HEADER</span>
<span class="p">{</span> 
	<span class="kt">short</span> <span class="n">m_sSourPort</span><span class="p">;</span>        　　　　　　<span class="c1">//源端口号16bit
</span><span class="c1"></span>	<span class="kt">short</span> <span class="n">m_sDestPort</span><span class="p">;</span>       　　　　　　 <span class="c1">//目的端口号16bit 
</span><span class="c1"></span>	<span class="kt">unsigned</span> <span class="kt">int</span> <span class="n">m_uiSequNum</span><span class="p">;</span>       　　<span class="c1">//序列号32bit 
</span><span class="c1"></span>	<span class="kt">unsigned</span> <span class="kt">int</span> <span class="n">m_uiAcknowledgeNum</span><span class="p">;</span>  <span class="c1">//确认号32bit 
</span><span class="c1"></span>	<span class="kt">short</span> <span class="n">m_sHeaderLenAndFlag</span><span class="p">;</span>      　　<span class="c1">//前4位：TCP头长度；中6位：保留；后6位：标志位
</span><span class="c1"></span>	<span class="kt">short</span> <span class="n">m_sWindowSize</span><span class="p">;</span>       　　　　　<span class="c1">//窗口大小16bit
</span><span class="c1"></span>	<span class="kt">short</span> <span class="n">m_sCheckSum</span><span class="p">;</span>        　　　　　 <span class="c1">//检验和16bit
</span><span class="c1"></span>	<span class="kt">short</span> <span class="n">m_surgentPointer</span><span class="p">;</span>      　　　　 <span class="c1">//紧急数据偏移量16bit
</span><span class="c1"></span><span class="p">}</span><span class="n">__attribute__</span><span class="p">((</span><span class="n">packed</span><span class="p">))</span><span class="n">TCP_HEADER</span><span class="p">,</span> <span class="o">*</span><span class="n">PTCP_HEADER</span><span class="p">;</span>
<span class="cm">/*TCP头中的选项定义 
</span><span class="cm">
</span><span class="cm">kind(8bit)+Length(8bit，整个选项的长度，包含前两部分)+内容(如果有的话)
</span><span class="cm">
</span><span class="cm">KIND =
</span><span class="cm">	1表示 无操作NOP，无后面的部分
</span><span class="cm">	2表示 maximum segment   后面的LENGTH就是maximum segment选项的长度（以byte为单位，1+1+内容部分长度）
</span><span class="cm">	3表示 windows scale     后面的LENGTH就是 windows scale选项的长度（以byte为单位，1+1+内容部分长度）
</span><span class="cm">	4表示 SACK permitted    LENGTH为2，没有内容部分
</span><span class="cm">	5表示这是一个SACK包     LENGTH为2，没有内容部分
</span><span class="cm">	8表示时间戳，LENGTH为10，含8个字节的时间戳
</span><span class="cm">*/</span>
</code></pre></td></tr></table>
</div>
</div><p>16位源端口号和16位目的端口号。</p>
<p><strong>32位序号</strong>：</p>
<p>​	一次TCP通信过程中某一个传输方向上的字节流的每个字节的编号，通过这个来确认发送的数据有序，比如现在序列号为1000，发送了1000，下一个序列号就是2000。</p>
<p><strong>32位确认号</strong>：</p>
<p>​	用来响应TCP报文段，给收到的TCP报文段的序号加1，三握时还要携带自己的序号。</p>
<p><strong>4位头部长度</strong>：</p>
<p>​	标识该TCP头部有多少个4字节，共表示最长15*4=60字节。同IP头部。</p>
<p><strong>6位保留</strong>：</p>
<p>​	6位标志。URG（紧急指针是否有效）ACK（表示确认号是否有效）PSH（提示接收端应用程序应该立即从TCP接收缓冲区读走数据）RST（表示要求对方重新建立连接）SYN（表示请求建立一个连接）FIN（表示通知对方本端要关闭连接）</p>
<p><strong>16位窗口大小</strong>：</p>
<p>​	TCP流量控制的一个手段，用来告诉对端TCP缓冲区还能容纳多少字节。</p>
<p><strong>16位校验和</strong>：</p>
<p>​	由发送端填充，接收端对报文段执行CRC算法以检验TCP报文段在传输中是否损坏。</p>
<p><strong>16位紧急指针</strong>：</p>
<p>​	一个正的偏移量，它和序号段的值相加表示最后一个紧急数据的下一字节的序号。</p>
<p><strong>标志位字段（U、A、P、R、S、F）</strong>：</p>
<p>占6比特。各比特的含义如下：</p>
<ul>
<li>
<p><strong>URG</strong>：紧急指针（urgent pointer）有效。</p>
</li>
<li>
<p><strong>ACK</strong>：确认序号有效。</p>
</li>
<li>
<p><strong>PSH</strong>：接收方应该尽快将这个报文段交给应用层。</p>
</li>
<li>
<p><strong>RST</strong>：重建连接。</p>
</li>
<li>
<p><strong>SYN</strong>：发起一个连接。</p>
</li>
<li>
<p><strong>FIN</strong>：释放一个连接。</p>
</li>
<li>
<p><strong>窗口大小字段</strong>：占16比特。此字段用来进行流量控制。单位为字节数，这个值是本机期望一次接收的字节数。</p>
</li>
<li>
<p><strong>TCP校验和字段</strong>：占16比特。对整个TCP报文段，即TCP头部和TCP数据进行校验和计算，并由目标端进行验证。</p>
</li>
<li>
<p><strong>紧急指针字段</strong>：占16比特。它是一个偏移量，和序号字段中的值相加表示紧急数据最后一个字节的序号。</p>
</li>
<li>
<p><strong>选项字段</strong>：占32比特。可能包括&quot;窗口扩大因子&quot;、&ldquo;时间戳&quot;等选项。</p>
</li>
<li>
<p>抓取源端口大于1024的TCP数据包</p>
</li>
</ul>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;tcp[0:2] &gt; 1024&#39;</span>
</code></pre></td></tr></table>
</div>
</div><ul>
<li>匹配TCP数据包的特殊标记</li>
</ul>
<p>TCP标记定义在TCP头的第十四个字节</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span><span class="lnt">4
</span><span class="lnt">5
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"> +-+-+-+-+-+-+-+-+
 <span class="p">|</span>C<span class="p">|</span>E<span class="p">|</span>U<span class="p">|</span>A<span class="p">|</span>P<span class="p">|</span>R<span class="p">|</span>S<span class="p">|</span>F<span class="p">|</span>
 <span class="p">|</span>W<span class="p">|</span>C<span class="p">|</span>R<span class="p">|</span>C<span class="p">|</span>S<span class="p">|</span>S<span class="p">|</span>Y<span class="p">|</span>I<span class="p">|</span>
 <span class="p">|</span>R<span class="p">|</span>E<span class="p">|</span>G<span class="p">|</span>K<span class="p">|</span>H<span class="p">|</span>T<span class="p">|</span>N<span class="p">|</span>N<span class="p">|</span>
 +-+-+-+-+-+-+-+-+
</code></pre></td></tr></table>
</div>
</div><ul>
<li>只抓SYN包，第十四字节是二进制的00000010，也就是十进制的2</li>
</ul>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;tcp[13] = 2&#39;</span>
</code></pre></td></tr></table>
</div>
</div><ul>
<li>抓SYN, ACK （00010010 or 18）</li>
</ul>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;tcp[13] = 18&#39;</span>
</code></pre></td></tr></table>
</div>
</div><ul>
<li>抓SYN或者SYN-ACK</li>
</ul>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;tcp[13] &amp; 2 = 2&#39;</span>
</code></pre></td></tr></table>
</div>
</div><ul>
<li>抓PSH-ACK</li>
</ul>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;tcp[13] = 24&#39;</span>
</code></pre></td></tr></table>
</div>
</div><ul>
<li>抓所有包含FIN标记的包（FIN通常和ACK一起，表示幽会完了，回见）</li>
</ul>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;tcp[13] &amp; 1 = 1&#39;</span>
</code></pre></td></tr></table>
</div>
</div><ul>
<li>抓RST</li>
</ul>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;tcp[13] &amp; 4 = 4&#39;</span>
</code></pre></td></tr></table>
</div>
</div><h2 id="常用的字段偏移名字">常用的字段偏移名字</h2>
<p>tcpdump考虑了一些数字恐惧症者的需求，提供了部分常用的字段偏移名字：</p>
<ul>
<li><code>icmptype</code> (ICMP类型字段)</li>
<li><code>icmpcode</code> (ICMP符号字段)</li>
<li><code>tcpflags</code> (TCP标记字段)</li>
</ul>
<p><strong>ICMP类型值有</strong>：</p>
<p><code>icmp-echoreply</code>, <code>icmp-unreach</code>, <code>icmp-sourcequench</code>, <code>icmp-redirect</code>,<code> icmp-echo</code>,<code> icmp-routeradvert</code>,<code> icmp-routersolicit</code>,<code> icmp-timxceed</code>,<code> icmp-paramprob</code>,<code> icmp-tstamp</code>,<code> icmp-tstampreply</code>,<code> icmp-ireq</code>,<code> icmp-ireqreply</code>,<code> icmp-maskreq</code>,<code> icmp-maskreply</code></p>
<p><strong>TCP标记值</strong>：</p>
<p><code>tcp-fin</code>, <code>tcp-syn</code>, <code>tcp-rst</code>, <code>tcp-push</code>, <code>tcp-push</code>, <code>tcp-ack</code>, <code>tcp-urg</code></p>
<p>这样上面按照TCP标记位抓包的就可以写直观的表达式了：</p>
<ul>
<li>只抓SYN包</li>
</ul>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;tcp[tcpflags] = tcp-syn&#39;</span>
</code></pre></td></tr></table>
</div>
</div><ul>
<li>抓SYN, ACK</li>
</ul>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;tcp[tcpflags] &amp; tcp-syn != 0 and tcp[tcpflags] &amp; tcp-ack != 0&#39;</span>
</code></pre></td></tr></table>
</div>
</div><h2 id="抓smtp数据">抓SMTP数据</h2>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;((port 25) and (tcp[(tcp[12]&gt;&gt;2):4] = 0x4d41494c))&#39;</span>
</code></pre></td></tr></table>
</div>
</div><p>抓取数据区开始为&quot;MAIL&quot;的包，&ldquo;MAIL&quot;的十六进制为0x4d41494c。</p>
<h2 id="抓http-get数据">抓HTTP GET数据</h2>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;tcp[(tcp[12]&gt;&gt;2):4] = 0x47455420&#39;</span>
</code></pre></td></tr></table>
</div>
</div><p>&ldquo;GET &ldquo;的十六进制是47455420</p>
<h2 id="抓ssh返回">抓SSH返回</h2>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;tcp[(tcp[12]&gt;&gt;2):4] = 0x5353482D&#39;</span>
</code></pre></td></tr></table>
</div>
</div><p>　&ldquo;SSH-&ldquo;的十六进制是0x5353482D</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell">tcpdump -i eth1 <span class="s1">&#39;(tcp[(tcp[12]&gt;&gt;2):4] = 0x5353482D) and (tcp[((tcp[12]&gt;&gt;2)+4):2] = 0x312E)&#39;</span>
</code></pre></td></tr></table>
</div>
</div></div><div class="post-footer" id="post-footer">
    <div class="post-info">
        <div class="post-info-line">
            <div class="post-info-mod">
                <span>更新于 2022-01-29</span>
            </div>
            <div class="post-info-license"></div>
        </div>
        <div class="post-info-line">
            <div class="post-info-md"><span>
                            <a class="link-to-markdown" href="/Blog/tcpdump%E5%91%BD%E4%BB%A4%E9%AB%98%E7%BA%A7%E8%BF%87%E6%BB%A4%E6%96%B9%E5%BC%8F/index.md" target="_blank">阅读原始文档</a>
                        </span></div>
            <div class="post-info-share">
                <span><a href="javascript:void(0);" title="分享到 Twitter" data-sharer="twitter" data-url="https://alexwuyh.gitee.io/Blog/tcpdump%E5%91%BD%E4%BB%A4%E9%AB%98%E7%BA%A7%E8%BF%87%E6%BB%A4%E6%96%B9%E5%BC%8F/" data-title="tcpdump命令高级过滤方式" data-via="Alex_WuYh" data-hashtags="TCPDump,Network,Linux"><i class="fab fa-twitter fa-fw"></i></a><a href="javascript:void(0);" title="分享到 Facebook" data-sharer="facebook" data-url="https://alexwuyh.gitee.io/Blog/tcpdump%E5%91%BD%E4%BB%A4%E9%AB%98%E7%BA%A7%E8%BF%87%E6%BB%A4%E6%96%B9%E5%BC%8F/" data-hashtag="TCPDump"><i class="fab fa-facebook-square fa-fw"></i></a><a href="javascript:void(0);" title="分享到 WhatsApp" data-sharer="whatsapp" data-url="https://alexwuyh.gitee.io/Blog/tcpdump%E5%91%BD%E4%BB%A4%E9%AB%98%E7%BA%A7%E8%BF%87%E6%BB%A4%E6%96%B9%E5%BC%8F/" data-title="tcpdump命令高级过滤方式" data-web><i class="fab fa-whatsapp fa-fw"></i></a><a href="javascript:void(0);" title="分享到 Line" data-sharer="line" data-url="https://alexwuyh.gitee.io/Blog/tcpdump%E5%91%BD%E4%BB%A4%E9%AB%98%E7%BA%A7%E8%BF%87%E6%BB%A4%E6%96%B9%E5%BC%8F/" data-title="tcpdump命令高级过滤方式"><i data-svg-src="/Blog/lib/simple-icons/icons/line.min.svg"></i></a><a href="javascript:void(0);" title="分享到 微博" data-sharer="weibo" data-url="https://alexwuyh.gitee.io/Blog/tcpdump%E5%91%BD%E4%BB%A4%E9%AB%98%E7%BA%A7%E8%BF%87%E6%BB%A4%E6%96%B9%E5%BC%8F/" data-title="tcpdump命令高级过滤方式" data-ralateuid="AlexWuYh"><i class="fab fa-weibo fa-fw"></i></a><a href="javascript:void(0);" title="分享到 Myspace" data-sharer="myspace" data-url="https://alexwuyh.gitee.io/Blog/tcpdump%E5%91%BD%E4%BB%A4%E9%AB%98%E7%BA%A7%E8%BF%87%E6%BB%A4%E6%96%B9%E5%BC%8F/" data-title="tcpdump命令高级过滤方式" data-description=""><i data-svg-src="/Blog/lib/simple-icons/icons/myspace.min.svg"></i></a><a href="javascript:void(0);" title="分享到 Blogger" data-sharer="blogger" data-url="https://alexwuyh.gitee.io/Blog/tcpdump%E5%91%BD%E4%BB%A4%E9%AB%98%E7%BA%A7%E8%BF%87%E6%BB%A4%E6%96%B9%E5%BC%8F/" data-title="tcpdump命令高级过滤方式" data-description=""><i class="fab fa-blogger fa-fw"></i></a><a href="javascript:void(0);" title="分享到 Evernote" data-sharer="evernote" data-url="https://alexwuyh.gitee.io/Blog/tcpdump%E5%91%BD%E4%BB%A4%E9%AB%98%E7%BA%A7%E8%BF%87%E6%BB%A4%E6%96%B9%E5%BC%8F/" data-title="tcpdump命令高级过滤方式"><i class="fab fa-evernote fa-fw"></i></a></span>
            </div>
        </div>
    </div>

    <div class="post-info-more">
        <section class="post-tags"><i class="fas fa-tags fa-fw"></i>&nbsp;<a href="/Blog/tags/tcpdump/">TCPDump</a>,&nbsp;<a href="/Blog/tags/network/">Network</a>,&nbsp;<a href="/Blog/tags/linux/">Linux</a></section>
        <section>
            <span><a href="javascript:void(0);" onclick="window.history.back();">返回</a></span>&nbsp;|&nbsp;<span><a href="/Blog/">主页</a></span>
        </section>
    </div>

    <div class="post-nav"><a href="/Blog/2021%E5%B9%B410%E6%9C%88-%E5%87%BA%E5%B7%AE%E6%89%AB%E8%A1%97%E8%AE%B0%E5%BD%95%E4%B9%8B%E6%AD%A6%E6%B1%89%E7%AF%87/" class="prev" rel="prev" title="2021年10月-出差扫街记录之武汉篇"><i class="fas fa-angle-left fa-fw"></i>2021年10月-出差扫街记录之武汉篇</a>
            <a href="/Blog/tcpdump%E5%91%BD%E4%BB%A4%E4%BD%BF%E7%94%A8%E7%AE%80%E4%BB%8B/" class="next" rel="next" title="tcpdump命令使用简介">tcpdump命令使用简介<i class="fas fa-angle-right fa-fw"></i></a></div>
</div>
<div id="comments"><div id="valine" class="comment"></div><noscript>
                Please enable JavaScript to view the comments powered by <a href="https://valine.js.org/">Valine</a>.
            </noscript></div></article></div>
            </main><footer class="footer">
        <div class="footer-container"><div class="footer-line">由 <a href="https://gohugo.io/" target="_blank" rel="noopener noreffer" title="Hugo 0.92.0">Hugo</a> 强力驱动 | 主题 - <a href="https://github.com/dillonzq/LoveIt" target="_blank" rel="noopener noreffer" title="LoveIt 0.2.10"><i class="far fa-kiss-wink-heart fa-fw"></i> LoveIt</a>
                </div><div class="footer-line"><i class="far fa-copyright fa-fw"></i><span itemprop="copyrightYear">2020 - 2022</span><span class="author" itemprop="copyrightHolder">&nbsp;<a href="/Blog/" target="_blank">Alex Wu</a></span>&nbsp;|&nbsp;<span class="license"><a rel="license external nofollow noopener noreffer" href="https://creativecommons.org/licenses/by-nc/4.0/" target="_blank">CC BY-NC 4.0</a></span><span class="icp-splitter">&nbsp;|&nbsp;</span><br class="icp-br"/>
                    <span class="icp">蜀ICP备20004229号-1</span></div>
        </div>
    </footer></div>

        <div id="fixed-buttons"><a href="#" id="back-to-top" class="fixed-button" title="回到顶部">
                <i class="fas fa-arrow-up fa-fw"></i>
            </a><a href="#" id="view-comments" class="fixed-button" title="查看评论">
                <i class="fas fa-comment fa-fw"></i>
            </a>
        </div><link rel="stylesheet" href="/Blog/lib/valine/valine.min.css"><link rel="stylesheet" href="/Blog/lib/katex/katex.min.css"><link rel="stylesheet" href="/Blog/lib/katex/copy-tex.min.css"><link rel="stylesheet" href="/Blog/lib/cookieconsent/cookieconsent.min.css"><script type="text/javascript" src="/Blog/lib/valine/Valine.min.js"></script><script type="text/javascript" src="/Blog/lib/smooth-scroll/smooth-scroll.min.js"></script><script type="text/javascript" src="/Blog/lib/autocomplete/autocomplete.min.js"></script><script type="text/javascript" src="/Blog/lib/lunr/lunr.min.js"></script><script type="text/javascript" src="/Blog/lib/lunr/lunr.stemmer.support.min.js"></script><script type="text/javascript" src="/Blog/lib/lunr/lunr.zh.min.js"></script><script type="text/javascript" src="/Blog/lib/lazysizes/lazysizes.min.js"></script><script type="text/javascript" src="/Blog/lib/clipboard/clipboard.min.js"></script><script type="text/javascript" src="/Blog/lib/sharer/sharer.min.js"></script><script type="text/javascript" src="/Blog/lib/typeit/typeit.min.js"></script><script type="text/javascript" src="/Blog/lib/katex/katex.min.js"></script><script type="text/javascript" src="/Blog/lib/katex/auto-render.min.js"></script><script type="text/javascript" src="/Blog/lib/katex/copy-tex.min.js"></script><script type="text/javascript" src="/Blog/lib/katex/mhchem.min.js"></script><script type="text/javascript" src="/Blog/lib/cookieconsent/cookieconsent.min.js"></script><script type="text/javascript">window.config={"code":{"copyTitle":"复制到剪贴板","maxShownLines":10},"comment":{"valine":{"appId":"o5gq6eLbupSlKq678zx1aKcd-gzGzoHsz","appKey":"S2CU3haJIhCbfVoIxhtrIzNp","avatar":"mp","el":"#valine","emojiCDN":"https://cdn.jsdelivr.net/npm/emoji-datasource-google@5.0.1/img/google/64/","emojiMaps":{"100":"1f4af.png","alien":"1f47d.png","anger":"1f4a2.png","angry":"1f620.png","anguished":"1f627.png","astonished":"1f632.png","black_heart":"1f5a4.png","blue_heart":"1f499.png","blush":"1f60a.png","bomb":"1f4a3.png","boom":"1f4a5.png","broken_heart":"1f494.png","brown_heart":"1f90e.png","clown_face":"1f921.png","cold_face":"1f976.png","cold_sweat":"1f630.png","confounded":"1f616.png","confused":"1f615.png","cry":"1f622.png","crying_cat_face":"1f63f.png","cupid":"1f498.png","dash":"1f4a8.png","disappointed":"1f61e.png","disappointed_relieved":"1f625.png","dizzy":"1f4ab.png","dizzy_face":"1f635.png","drooling_face":"1f924.png","exploding_head":"1f92f.png","expressionless":"1f611.png","face_vomiting":"1f92e.png","face_with_cowboy_hat":"1f920.png","face_with_hand_over_mouth":"1f92d.png","face_with_head_bandage":"1f915.png","face_with_monocle":"1f9d0.png","face_with_raised_eyebrow":"1f928.png","face_with_rolling_eyes":"1f644.png","face_with_symbols_on_mouth":"1f92c.png","face_with_thermometer":"1f912.png","fearful":"1f628.png","flushed":"1f633.png","frowning":"1f626.png","ghost":"1f47b.png","gift_heart":"1f49d.png","green_heart":"1f49a.png","grimacing":"1f62c.png","grin":"1f601.png","grinning":"1f600.png","hankey":"1f4a9.png","hear_no_evil":"1f649.png","heart":"2764-fe0f.png","heart_decoration":"1f49f.png","heart_eyes":"1f60d.png","heart_eyes_cat":"1f63b.png","heartbeat":"1f493.png","heartpulse":"1f497.png","heavy_heart_exclamation_mark_ornament":"2763-fe0f.png","hole":"1f573-fe0f.png","hot_face":"1f975.png","hugging_face":"1f917.png","hushed":"1f62f.png","imp":"1f47f.png","innocent":"1f607.png","japanese_goblin":"1f47a.png","japanese_ogre":"1f479.png","joy":"1f602.png","joy_cat":"1f639.png","kiss":"1f48b.png","kissing":"1f617.png","kissing_cat":"1f63d.png","kissing_closed_eyes":"1f61a.png","kissing_heart":"1f618.png","kissing_smiling_eyes":"1f619.png","laughing":"1f606.png","left_speech_bubble":"1f5e8-fe0f.png","love_letter":"1f48c.png","lying_face":"1f925.png","mask":"1f637.png","money_mouth_face":"1f911.png","nauseated_face":"1f922.png","nerd_face":"1f913.png","neutral_face":"1f610.png","no_mouth":"1f636.png","open_mouth":"1f62e.png","orange_heart":"1f9e1.png","partying_face":"1f973.png","pensive":"1f614.png","persevere":"1f623.png","pleading_face":"1f97a.png","pouting_cat":"1f63e.png","purple_heart":"1f49c.png","rage":"1f621.png","relaxed":"263a-fe0f.png","relieved":"1f60c.png","revolving_hearts":"1f49e.png","right_anger_bubble":"1f5ef-fe0f.png","robot_face":"1f916.png","rolling_on_the_floor_laughing":"1f923.png","scream":"1f631.png","scream_cat":"1f640.png","see_no_evil":"1f648.png","shushing_face":"1f92b.png","skull":"1f480.png","skull_and_crossbones":"2620-fe0f.png","sleeping":"1f634.png","sleepy":"1f62a.png","slightly_frowning_face":"1f641.png","slightly_smiling_face":"1f642.png","smile":"1f604.png","smile_cat":"1f638.png","smiley":"1f603.png","smiley_cat":"1f63a.png","smiling_face_with_3_hearts":"1f970.png","smiling_imp":"1f608.png","smirk":"1f60f.png","smirk_cat":"1f63c.png","sneezing_face":"1f927.png","sob":"1f62d.png","space_invader":"1f47e.png","sparkling_heart":"1f496.png","speak_no_evil":"1f64a.png","speech_balloon":"1f4ac.png","star-struck":"1f929.png","stuck_out_tongue":"1f61b.png","stuck_out_tongue_closed_eyes":"1f61d.png","stuck_out_tongue_winking_eye":"1f61c.png","sunglasses":"1f60e.png","sweat":"1f613.png","sweat_drops":"1f4a6.png","sweat_smile":"1f605.png","thinking_face":"1f914.png","thought_balloon":"1f4ad.png","tired_face":"1f62b.png","triumph":"1f624.png","two_hearts":"1f495.png","unamused":"1f612.png","upside_down_face":"1f643.png","weary":"1f629.png","white_frowning_face":"2639-fe0f.png","white_heart":"1f90d.png","wink":"1f609.png","woozy_face":"1f974.png","worried":"1f61f.png","yawning_face":"1f971.png","yellow_heart":"1f49b.png","yum":"1f60b.png","zany_face":"1f92a.png","zipper_mouth_face":"1f910.png","zzz":"1f4a4.png"},"enableQQ":false,"highlight":true,"lang":"zh-cn","pageSize":10,"placeholder":"你的评论 ...","recordIP":true,"visitor":true}},"cookieconsent":{"content":{"dismiss":"同意","link":"了解更多","message":"本网站使用 Cookies 来改善您的浏览体验."},"enable":true,"palette":{"button":{"background":"#f0f0f0"},"popup":{"background":"#1aa3ff"}},"theme":"edgeless"},"data":{"id-1":"Simple Life","id-2":"Simple Life"},"math":{"delimiters":[{"display":true,"left":"$$","right":"$$"},{"display":true,"left":"\\[","right":"\\]"},{"display":false,"left":"$","right":"$"},{"display":false,"left":"\\(","right":"\\)"}],"strict":false},"search":{"highlightTag":"em","lunrIndexURL":"/Blog/index.json","lunrLanguageCode":"zh","lunrSegmentitURL":"/Blog/lib/lunr/lunr.segmentit.js","maxResultLength":10,"noResultsFound":"没有找到结果","snippetLength":50,"type":"lunr"},"typeit":{"cursorChar":"|","cursorSpeed":1000,"data":{"id-1":["id-1"],"id-2":["id-2"]},"duration":-1,"speed":100}};</script><script type="text/javascript" src="/Blog/js/theme.min.js"></script><script type="text/javascript">
            window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}gtag('js', new Date());
            gtag('config', 'G-KJGDZS4RKJ', { 'anonymize_ip': true });
        </script><script type="text/javascript" src="https://www.googletagmanager.com/gtag/js?id=G-KJGDZS4RKJ" async></script></body>
</html>
